Systems and methods for identifying a document with forged information

ABSTRACT

Methods and systems are provided for analyzing and assessing documents using a writing profile for documents, such as a payment instrument. A method may include providing a document to a computer system. In an embodiment, the method may further include comparing writing in information fields of the document to at least one forger writing profile representation. In some embodiments, at least one forger writing profile representation may be obtained from at least one information field of at least one document that includes forged information. In an embodiment, the document may be identified as a document including forged information from an approximate match of at least one forger writing profile representation with writing in the document.

PRIORITY CLAIM

This application is a continuation application of and claims priority toU.S. patent application Ser. No. 10/389,265 entitled “Systems andMethods For Identifying a Document With Forged Information” filed byHoule, et al. on Mar. 14, 2003 now abandoned, which claims priority toU.S. Provisional Application No. 60/364,675 entitled “Systems andMethods for Handwriting Analysis in Documents,” filed Mar. 15, 2002.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention generally relates to analyzing information indocuments such as payment instruments. Certain embodiments relate tocomputer-implemented systems and methods for analyzing and assessingdocuments.

2. Description of the Related Art

Fraud related to forgery of documents, such as checks, has increasedsteadily worldwide over the past few years. For example, in Europe fraudhas doubled in the past two years. This is a very difficult problemmainly because of the wide range of techniques used to reroute moneyfrom an account to a fraudulent account. Fraud may be found in anydocument-based business where money transfers take place. There has beena significant amount of effort applied in developing technology, such assignature verification, for assessing forgeries in financial documents.

Many financial institutions, such as banks, are required to keep copiesof processed financial documents for a long period of time, for example,months, and even years. Such institutions commonly employ image-basedfinancial document systems that store images of processed documents inthe form of images on a database on a computer system.

Databases including images depicting handwriting known to be authenticare an important resource for methods and systems of assessing forgery.A handwriting sample of unknown validity, such as a signature, may becompared to images in such a database to determine if the handwritingsample is a forgery. However, such a process may be difficult andexpensive if the database includes a very large amount of image data. Inaddition, many methods and systems for assessing forgery in financialdocuments focus on assessing forgery in a limited portion of thedocument, for example, of a signature. Such methods and systems may leadto a large number of financial documents being incorrectly labeled ascontaining forgeries, as well as failing to identify forged contents innon-signature portions of a document.

U.S. Pat. No. 6,157,731 Hu et al. discloses a signature verificationmethod and is incorporated by reference as if fully set forth herein.The method involves segmenting a smoothed and normalized signature and,for each segment, evaluating at least one local feature to obtain afeature value vector.

A method and system of recognizing handwritten words in scanneddocuments is disclosed in U.S. Pat. No. 6,108,444 to Syeda-Mahmood andis incorporated by reference as if fully set forth herein. A method ofdetecting and recognizing handwritten words is described. Theapplications described in the patent are directed to the use ofhandwriting recognition algorithms as part of keyword searches.

U.S. Pat. No. 6,084,985 to Dolfing et al. discloses a method for on-linehandwriting recognition and is incorporated by reference as if fully setforth herein. The method employs feature vectors based on aggregatedobservations.

U.S. Pat. No. 5,995,953 to Rindtorff et al. discloses a method ofcomparing handwriting and signatures and is incorporated by reference asif fully set forth herein. The method relies on comparison of featuresof a signature rather than the images of signatures.

U.S. Pat. No. 5,909,500 to Moore discloses a method of signatureverification and is incorporated by reference as if fully set forthherein. The method is based on analysis of the environs attendant to thesignature string.

U.S. Pat. No. 5,710,916 to Barbara et al. discloses a method andapparatus for similarity matching of handwritten data objects and isincorporated by reference as if fully set forth herein.

A method of signature verification is disclosed in U.S. Pat. No.5,828,772 to Kashi et al. The method compares the numerical values ofparameters evaluated on a trial signature with stored reference dataderived from previously entered reference signatures.

U.S. Pat. No. 5,680,470 to Moussa et al. discloses a method of automatedsignature verification and is incorporated by reference as if fully setforth herein. In the method, a test signature, for example, a signatureentered by an operator, may be preprocessed and examined for testfeatures. The test features may be compared against features of a set oftemplate signatures, and verified in response to the presence or absenceof the test features in the template signatures.

U.S. Pat. No. 5,454,046 to Carman discloses a universal handwritingrecognition system and is incorporated by reference as if fully setforth herein. The system converts user-entered time ordered strokesequences into computer readable text.

SUMMARY OF THE INVENTION

An embodiment of the present invention relates to a computer-implementedmethod for analyzing and assessing fraud in documents. Analysis andassessment of documents may use a profile created for authorized writersof a document.

In one embodiment, a method of generating a writing profile on acomputer system may include providing one or more documents to thecomputer system. In some embodiments, at least one of the documents mayinclude at least one information field. In other embodiments, at leastone of the documents may include at least two information fields. Themethod may further include determining at least one writing profilerepresentation for at least two of the information fields using writingfrom at least one of the information fields. Alternatively, the methodmay include determining at least one writing profile representation forat least one of the information fields using writing from at least twoof the information fields. In other embodiments, at least two writingprofile representations for at least one of the information fields maybe assessed using writing from at least one of the information fields.

In an embodiment, a method of generating a writing profile on a computersystem may further include providing one or more additional documents tothe computer system. At least one of the additional documents mayinclude at least one information field. In another embodiment, at leastone of the additional documents may include at least two informationfields. The method may further include updating at least one of thewriting profile representations using at least one of the informationfields of at least one of the additional documents.

In an embodiment, a method of assessing a document using a computersystem may include providing a document to the computer system. In someembodiments, the document may include at least one information field.Alternatively, the document may also include at least two informationfields. The method may further include comparing writing in at least twoof the information fields of the document to at least one writingprofile representation. At least one writing profile representation maybe from at least one information field of at least one other document.Alternatively, the method may include comparing writing in at least oneof the information fields of the document to at least one writingprofile representation. At least one writing profile representation maybe from at least two information fields of at least one other document.In other embodiments, writing in at least one of the information fieldsof the document may be compared to at least two writing profilerepresentations. At least two writing profile representations may befrom at least one information field of at least one other document.

In one embodiment, a method of assessing information in a document usinga computer system may include obtaining information on writing in aninformation field of a document. The document may include at least twoinformation fields. The method may further include comparing theobtained written information in the information field and writteninformation in at least one other information field to at least onewriting profile representation. In another embodiment, the method mayinclude comparing the obtained written information in the informationfield and written information in at least two other information fieldsto at least one writing profile representation. Alternatively, theobtained written information in the information field and writteninformation in at least one other information field may be compared toat least two writing profile representations from at least one otherdocument.

In some embodiments, at least one of the writing profile representationsmay include written information from the information field and writteninformation from at least one of the other information fields. In otherembodiments, at least one of the writing profile representations mayinclude written information from the information field and writteninformation from at least two of the other information fields from atleast the one of the other documents. Alternatively, at least two of thewriting profile representations may include written information from theinformation field and written information from at least one of the otherinformation fields from at least the one other document.

In an embodiment, a method of identifying a document with forgedinformation using a computer system may include providing a document tothe computer system. The document may include at least one informationfield. Alternatively, the document may include at least two informationfields. The method may further include comparing writing in at least twoof the information fields of the document to at least one forger writingprofile representation. At least one forger writing profilerepresentation may be from at least one information field of at leastone document that includes forged information. In another embodiment,the method may include comparing writing in at least one of theinformation fields of the document to at least one forger writingprofile representation. At least one forger writing profile may be fromat least two information fields of at least one document that includesforger information. Alternatively, writing in at least one of theinformation fields of the document may be compared to at least twoforger writing profile representations. At least one forger writingprofile representation may be from at least one information field of atleast one document that includes forger information.

The method may additionally include identifying the document as adocument that includes forged information. The identification may bemade from an approximate match of at least one forger writing profilerepresentation with writing in the document.

In certain embodiments, a method of capturing written information froman information field of a document using a computer system may includeproviding a document to the computer system. The document may include atleast one information field. The method may further include assessingwhether writing in an information field approximately matches a writingprofile representation. The writing profile representation may be fromat least one information field from at least one other document. In anembodiment, at least one matching writing profile representation isassociated with a corresponding text representation in a computerprocessable format in memory on the computer system. Additionally, themethod may include associating the information field with the textrepresentation corresponding to the matching writing profilerepresentation.

In an embodiment, a method of assessing a document using a computersystem may include providing a document to the computer system. In someembodiments, the document may include at least one information field.Alternatively, the document may include at least two information fields.The method may further include comparing pre-printed information in atleast two of the information fields of the document to at least onepre-printed profile representation. At least one pre-printed profilerepresentation may be from at least one information field of at leastone other document. Alternatively, the method may include comparingpre-printed text in at least one of the information fields of thedocument to at least one pre-printed profile representation. At leastone pre-printed profile representation may be from at least oneinformation field of at least one other document. In other embodiments,pre-printed information in at least one of the information fields of thedocument may be compared to at least two pre-printed profilerepresentations. At least two pre-printed profile representations may befrom at least one information field of at least one other document.

BRIEF DESCRIPTION OF THE DRAWINGS

A better understanding of the present invention may be obtained when thefollowing detailed description of preferred embodiments is considered inconjunction with the following drawings, in which:

FIG. 1 depicts an embodiment of a network diagram of a wide area networksuitable for implementing various embodiments;

FIG. 2 depicts an embodiment of a computer system suitable forimplementing various embodiments;

FIG. 3 illustrates an embodiment of a system and method for analyzingdocuments;

FIG. 4 depicts an illustration of a check;

FIG. 5 depicts an illustration of a giro;

FIG. 6 depicts a flow chart of a method for assessing fraud indocuments;

FIG. 7 illustrates writing features included in mathematicalrepresentations of writing;

FIG. 8 illustrates writing features included in mathematicalrepresentations of writing;

FIG. 9 illustrates writing features included in mathematicalrepresentations of writing;

FIG. 10 illustrates legal amount entries in a legal amount field;

FIG. 11 depicts a flow chart of a method of generating a writingprofile;

FIG. 12 illustrates determining a handwriting profile from handwritingsamples;

FIG. 13 illustrates dynamic variation of handwriting;

FIG. 14 depicts a flow chart of a method of generating a writing profilefrom images in a computer database;

FIG. 15 depicts a flow chart of a method of generating a writing profilefrom images presented for processing;

FIG. 16 depicts a flow chart of a method for assessing a document;

FIG. 17 depicts a flow chart of a method for assessing a document;

FIG. 18 depicts a flow chart of a method for assessing a document;

FIGS. 19 and 20 illustrate assessing fraud in the signature field of agiro;

FIG. 21 is an illustration of assessing fraud in a check;

FIG. 22 is an illustration of assessing fraud in a giro;

FIG. 23 is an illustration of assessing fraud in the city field of agiro;

FIG. 24 depicts a flow chart of a method for assessing a document;

FIG. 25 illustrates converting a character in a handwriting image to amathematical representation;

FIG. 26 illustrates assessing fraud in a numeric field of a paymentinstrument;

FIG. 27 depicts a flow chart of a method for assessing a document;

FIG. 28 is an illustration of assessing fraud in a check;

FIG. 29 depicts a flow chart of a method for assessing a document;

FIG. 30 illustrates assessing fraud in a date field of a paymentinstrument;

FIG. 31 depicts a flow chart of a method for assessing a document;

FIG. 32 illustrates assessing fraud in a city field of a giro;

FIG. 33 is an illustration of assessing fraud in a check;

FIG. 34 depicts a flow chart of a method for assessing a document;

FIG. 35 depicts a flow chart of a method for assessing a document;

FIG. 36 depicts stock characteristics of a check;

FIG. 37 depicts a flow chart of a method for assessing a document;

FIG. 38 illustrates assessing fraud in a giro;

FIG. 39 depicts a flow chart of a method for assessing a document;

FIGS. 40 a-d illustrate assessing fraud in a giro;

FIG. 41 depicts a flow chart of a method for assessing a document;

FIG. 42 depicts a flow chart of a method for capturing writteninformation from a document; and

FIG. 43 illustrates capturing written information from a document.

While the invention is susceptible to various modifications andalternative forms, specific embodiments thereof are shown by way ofexample in the drawings and will herein be described in detail. Itshould be understood, however, that the drawings and detaileddescription thereto are not intended to limit the invention to theparticular form disclosed, but on the contrary, the intention is tocover all modifications, equivalents and alternatives falling within thespirit and scope of the present invention as defined by the appendedclaims.

DETAILED DESCRIPTION OF SEVERAL EMBODIMENTS

FIG. 1 illustrates a wide area network (“WAN”) according to oneembodiment. WAN 102 may be a network that spans a relatively largegeographical area. The Internet is an example of WAN 102. WAN 102typically includes a plurality of computer systems that may beinterconnected through one or more networks. Although one particularconfiguration is shown in FIG. 1, WAN 102 may include a variety ofheterogeneous computer systems and networks that may be interconnectedin a variety of ways and that may run a variety of softwareapplications.

One or more local area networks (“LANs”) 104 may be coupled to WAN 102.LAN 104 may be a network that spans a relatively small area. Typically,LAN 104 may be confined to a single building or group of buildings. Eachnode (i.e., individual computer system or device) on LAN 104 may haveits own CPU with which it may execute programs, and each node may alsobe able to access data and devices anywhere on LAN 104. LAN 104, thus,may allow many users to share devices (e.g., printers) and data storedon file servers. LAN 104 may be characterized by a variety of types oftopology (i.e., the geometric arrangement of devices on the network), ofprotocols (i.e., the rules and encoding specifications for sending data,and whether the network uses a peer-to-peer or client/serverarchitecture), and of media (e.g., twisted-pair wire, coaxial cables,fiber optic cables, and/or radio waves).

Each LAN 104 may include a plurality of interconnected computer systemsand optionally one or more other devices such as one or moreworkstations 110 a, one or more personal computers 112 a, one or morelaptop or notebook computer systems 114, one or more server computersystems 116, and one or more network printers 118. As illustrated inFIG. 1, an example LAN 104 may include one of each computer systems 110a, 112 a, 114, and 116, and one printer 118. LAN 104 may be coupled toother computer systems and/or other devices and/or other LANs 104through WAN 102.

One or more mainframe computer systems 120 may be coupled to WAN 102. Asshown, mainframe 120 may be coupled to a storage device or file server124 and mainframe terminals 122 a, 122 b, and 122 c. Mainframe terminals122 a, 122 b, and 122 c may access data stored in the storage device orfile server 124 coupled to or included in mainframe computer system 120.

WAN 102 may also include computer systems connected to WAN 102individually and not through LAN 104 for purposes of example,workstation 110 b and personal computer 112 b. For example, WAN 102 mayinclude computer systems that may be geographically remote and connectedto each other through the Internet.

FIG. 2 illustrates an embodiment of computer system 150 that may besuitable for implementing various embodiments of a system and method foranalyzing and assessing documents. Each computer system 150 typicallyincludes components such as CPU 152 with an associated memory mediumsuch as floppy disks 160. The memory medium may store programinstructions for computer programs. The program instructions may beexecutable by CPU 152. Computer system 150 may further include a displaydevice such as monitor 154, an alphanumeric input device such askeyboard 156, and a directional input device such as mouse 158. Computersystem 150 may be operable to execute the computer programs to implementcomputer-implemented systems and methods for analyzing and assessingdocuments.

Computer system 150 may include a memory medium on which computerprograms according to various embodiments may be stored. The term“memory medium” is intended to include an installation medium, e.g., aCD-ROM or floppy disks 160, a computer system memory such as DRAM, SRAM,EDO RAM, Rambus RAM, etc., or a non-volatile memory such as a magneticmedia, e.g., a hard drive or optical storage. The memory medium may alsoinclude other types of memory or combinations thereof. In addition, thememory medium may be located in a first computer which executes theprograms or may be located in a second different computer which connectsto the first computer over a network. In the latter instance, the secondcomputer may provide the program instructions to the first computer forexecution. Also, computer system 150 may take various forms such as apersonal computer system, mainframe computer system, workstation,network appliance, Internet appliance, personal digital assistant(“PDA”), television system or other device. In general, the term“computer system” may refer to any device having a processor thatexecutes instructions from a memory medium.

The memory medium may store a software program or programs operable toimplement a method for analyzing and assessing documents. The softwareprogram(s) may be implemented in various ways, including, but notlimited to, procedure-based techniques, component-based techniques,and/or object-oriented techniques, among others. For example, thesoftware programs may be implemented using ActiveX controls, C++objects, JavaBeans, Microsoft Foundation Classes (“MFC”), browser-basedapplications (e.g., Java applets), traditional programs, or othertechnologies or methodologies, as desired. A CPU such as host CPU 152executing code and data from the memory medium may include a means forcreating and executing the software program or programs according to theembodiments described herein.

Various embodiments may also include receiving or storing instructionsand/or data implemented in accordance with the foregoing descriptionupon a carrier medium. Suitable carrier media may include storage mediaor memory media such as magnetic or optical media, e.g., disk or CD-ROM,as well as signals such as electrical, electromagnetic, or digitalsignals, may be conveyed via a communication medium such as networks 102and/or 104 and/or a wireless link.

The systems and methods disclosed herein for analyzing and assessingdocuments may be applied to various kinds of documents that includehandwriting and other machine-printed information. Documents may beanalyzed and assessed for fraud or forgery using a profile created forone or more authorized writers of a document. Writers may includeindividuals, entities, and/or representatives of entities. Writers mayalso include machines or devices that print writing for individuals orentities. The profile may contain writing characteristics for one ormore authorized writers. As used herein, “writing” may refer to, but isnot limited to characters and symbols formed by an individual with aninstrument (e.g., pen, pencil, stylus, rubber stamp, etc.) and/or formedby a machine (e.g., printer, typewriter, etc). As used herein,“handwriting” may refer to writing done by an individual with a writingimplement, in particular, the form of writing peculiar to a particularperson. As used herein, “machine-printed writing” may refer to writingformed by a machine. Documents may include, but are not limited to,payment instruments, receipts, securities documents, invoices, accountapplications, leases, contracts, credit card receipts and slips, loanapplications, credit cards, debit cards, school applications, governmentdocuments such as social security cards or driver licenses, and legaldocuments such as wills or divorce decrees. As used herein, “forgery”refers to falsely and fraudulently making or altering a document. Adocument may be forged with handwriting, a machine, and/or by othermeans. A forger may make or create an entire document or alter only aportion of a document. For example, a forger may obtain a check of anaccount owner containing no entries and enter information necessary toobtain a payment. Alternatively, a forger may obtain a check completewith entries of an account owner and alter one or more portions of thecheck.

For example, payment instruments may include various types of commercialpaper such as a draft. As used herein, a “draft” is an order to pay.Generally, a draft involves three parties. One party, the “drawer,”orders another party, the drawee (often a bank), to pay money to a thirdparty, the “payee,” or to a bearer of the draft. A “check” is any draftdrawn on a bank and payable on demand. Alternatively, a paymentinstrument may include a “giro.” A “giro” is a check-like paymentinstrument commonly used to make payments in many European countries.

In one embodiment, a document may include variable written informationand stock characteristics. Stock characteristics refer to pre-printedinformation that tends not to vary on a particular set of documents. Aset of payment instruments for a payment instrument account may includeone or more stock characteristics. For example, stock characteristics orpre-printed information may include machine-printed text blocks,graphics elements (e.g., bank logo), and the relative positions and/orlocations of other stock characteristics. Machine-printed text blocksmay include, for example, the name and address of one or more accountowners and account numbers. Alternatively, variable written informationor writing refers to writing that tends to vary on a particular set ofdocuments. The content of variable written information may depend on aparticular purpose or transaction. For example, for a paymentinstrument, variable written information may include a payee, courtesyamount, date, etc.

Furthermore, a document may include one or more information fields. Inone embodiment, an “information field” may be a portion of a documentfor entering variable written information. For example, the one or moreaccount owners of a checking account are a set of writers or individualsthat may enter written information in various portions of a check. Forinstance, an account owner may write his or her signature in thesignature field of a check corresponding to the account of the accountowner. As used herein, an “account” refers to a formal businessarrangement providing for regular dealings or services, such as banking,and involving the establishment and maintenance of an account. Writteninformation may be entered into information fields of a check by amachine, such as a printer. In some embodiments, an “information field”may refer to pre-printed information on a document, or a document stockcharacteristic, such as graphic elements or machine-printed text.

FIG. 3 illustrates an embodiment of a system and method for analyzingand assessing documents. Document image archive 210 may include anarchive of images of documents that may include variable writteninformation and/or pre-printed information. The document images may becreated from valid processed documents that include valid writteninformation corresponding to known individuals or writers. The documentimages may also be created from unprocessed and/or forged documents. Asused herein, an “image” is a representation of a graphics image incomputer memory. The image may be composed of rows and columns of dots.The value of each dot, e.g., whether it is filled in or not, is storedusing one or more bits of data. A “bit,” short for binary digit, is thesmallest unit of information on a computer system.

In one embodiment, document image archive 210 may include a paymentinstrument archive that includes images of valid processed paymentinstruments. In some embodiments, the images in the archive may includeimages of several types of documents corresponding to known individualsor entities. For example, the archive may include images of checks andimages of credit card receipts corresponding to a particular individualor individuals or entity. The particular individual or individuals orentity may be authorized writers. “Authorized writers” generally referto writers permitted and/or with the legal right to make entries on adocument, such as one or more account owners of a payment instrumentaccount.

For example, a payment instrument archive may be created and stored byCheckVision software from Computer Sciences Corporation of El Segundo,Calif. A camera may be used to capture digital images of paymentinstruments. For example, a bank may capture digital images of paymentinstruments presented for payment. Digital images of payment instrumentsmay be archived for analysis. In one embodiment, the images may betransferred to archive 210 via the Internet. A database of images of anytype of document including variable handwritten information, variablemachine-printed information, and/or pre-printed information may becreated and stored on a memory medium.

As shown by data flow 218, document images from archive 210 may beprovided to document analyzer 214. Document analyzer 214 may create aprofile that corresponds to the writing of one or more individuals or anentity. The profile may also include pre-pre-printed information. Theprofile may be created from digital images of previously captureddocuments in the archive. In one embodiment, document analyzer 214 maybe a payment instrument analyzer that creates a payment instrumentaccount profile for an account from images of valid processed paymentinstruments of an account.

Document analyzer 214 may extract information from one or more images ofdocuments of writers to create the profile. The profile information mayinclude writing characteristics and patterns, data content, semanticpatterns, and document layout that uniquely characterize the writers andthe document. In one embodiment, the document profile may includeprofile information from more than one type of document corresponding toknown writers. As shown by data flow 220, a profile may be stored in aprofile database 212. In one embodiment, profile database 212 may be apayment instrument profile database. In certain embodiments, thedatabase may be stored in memory on a computer system. Alternatively thedatabase may be stored in memory on various types of portable memorymedia not coupled with a computer system. For example, a memory mediummay include a computer chip or magnetic strip. The computer chip ormagnetic strip may be coupled with a card (e.g., a credit card, debitcard, identification card, etc).

In one embodiment, document 213 may be provided to document analyzer214, as shown by data flow 230. Document 213 may include one or moreinformation fields that include written and/or pre-printed information.Written information in the one or more information fields may beasserted to have been entered by particular writers. Document 213 maybe, for example, an image of a payment instrument that was previouslypresented for payment to a bank. The writers may include one or moreaccount owners. Alternatively, document 213 may be a bank accountapplication written by an applicant. The writers asserted to haveentered written information on document 213 may correspond to a writingprofile that is stored on profile database 212. For example, document213 may be a payment instrument that corresponds to a payment instrumentaccount profile. Document analyzer 214 may perform one or more analysesor tests for assessing fraud on document 213 using a profile from theprofile database 212, as shown by data flow 222. A document may befraudulent if it has been altered, written, or created by an individualother than one of the authorized writers for a document, such as one ormore payment instrument account owners. An individual who fraudulentlywrites, alters, or creates a document may be referred to as a forger ofa document. For example, a “forger” of a payment instrument may be anindividual who alters or writes a payment instrument of an account notowned by the forger without the permission of one or more of the accountowners. In addition, a forger may be an individual who signs a creditcard slip corresponding to a credit card account not held by theindividual.

The results of the tests or analyses on document 213 may be provided toa fraud detector 216, as indicated by data flow 224. Fraud detector 216may assess from the tests or analyses whether document 213 ispotentially fraudulent. In one embodiment, if document 213 is assessednot to be a forgery, the computer system may notify a documentprocessing system 217 that the document is valid, as indicated by dataflow 226. Alternatively, fraud detector 216 may assess that document 213is potentially fraudulent. In this case, document 213 may be submitted,as indicated by data flow 228, for further review 219. The result ofdocument review 219 may be sent to document processing 217. For example,a reviewer may determine that a payment instrument is fraudulent andinstruct the bank not to make payment. The determination of whether thepayment instrument is fraudulent may involve further research. Forexample, a reviewer may contact the account owner corresponding to thepayment instrument. Rejected payment instruments may be returned todepositors.

In an alternative embodiment, document analyzer 214 may extractinformation from document 213 for purposes other than assessing fraud.For example, text from document may be recognized and extracted to savelabor that would be expended in keying in the text. In addition,information may be extracted from document 213 and stored in profiledatabase 212.

Furthermore, the information in the profile may be used for data mining.Data mining refers to the process of looking for hidden patterns in agroup of data. Data mining may be used to find correlations betweeninformation fields to predict the content of, for example, a paymentinstrument presented for payment. For instance, data mining may be ableto predict an entry in one information field of a document based on theentry in another.

In one embodiment, a profile may include specific information relatingto one or more information fields of a document. The specificinformation corresponding to each information field is generally enteredin writing by the writer of the document. Detection of handwriting in aninformation field of a document belonging to someone other than anauthorized writer is evidence of potential fraud. For example,handwriting in any information field of a payment instrument belongingto someone other than one of the account owners is evidence of fraud.

FIG. 4 depicts an illustration of a check that includes handwritteninformation in the information fields of the check. Check 264 includespayee field 266, date field 272, courtesy amount field 274, legal amountfield 268, memo field 270, and signature field 276. Payee field 266generally includes the name of an individual or entity. Date field 272may include a date after which the check may be paid in terms of amonth, day, and year. Courtesy amount field 274 may include the amount,for example, in dollars, in numeric form for which the check is written.Legal amount field 268 may include the amount in dollars in alphanumericform for which the check is written. Memo field 270 may include anyinformation a writer of the check may desire to enter. A writer mayenter information in the memo field relating to the purpose of thepayment, for example, “June Rent.” A writer may also enter an accountnumber that corresponds to an account the writer has with a payee. Forexample, a writer may enter a writer's account number with a utilitycompany or a writer's credit card account number. Signature field 276includes the handwritten signature of one of the owners of the account.As used herein, a “signature” may be defined as the name of a personwritten with the person's own hand. Label 265 refers to the stockcharacteristics and/or pre-printed information of the check.

FIG. 5 depicts an illustration of a giro that includes handwritteninformation in information fields of the giro. Giro 278 includes debitaccount fields 280, amount field 282, description field 284, creditaccount field 286, name field 288, city field 290, and signature field292. Giro 278 also includes text 294. Debit account field 280 includesthe number of an account to be debited or charged against to pay theamount for which the giro is written. Amount field 282 may include theamount, for example in euros, in numeric form for which the giro iswritten. Description field 284, like the memo field, may include anyinformation a writer of the giro may desire to enter. Credit accountfield 286 includes the number of an account to be credited in the amountfor which the giro is written. Name field 288 includes the payee of thegiro. City field 290 includes the name of the city where the giro creditrecipient's bank is located. Signature field 292 includes a signature ofone of the giro account owners.

In one embodiment, a writing profile, such as a payment instrumentaccount profile, may include profiles for one or more of the informationfields in a document. The profile of the information fields may includewriting characteristics and patterns, data content, and/or semanticpatterns that uniquely characterize the writing entered into informationfields by particular writers. An information field of a document, suchas a payment instrument, may include one or more entry types that thewriter of the document may enter in the information field. An entry typerefers, for example, to a specific name or number that one or moreowners of an account enter in a field. For instance, entry types of apayee field correspond to payee names to which account owners writechecks.

In an embodiment, a writing profile for a document, such as a paymentinstrument account profile, of an entry type of an information field mayinclude one or more representations of the entry type. The one or morerepresentations may be referred to as writing profile representations.Writing profile representations may include handwriting profilerepresentations and machine-printed profile representations. Anembodiment of a method of generating a payment instrument accountprofile for an account may include providing one or more paymentinstruments written by one or more account owners. At least one of thepayment instruments may include at least one information field. In oneembodiment, images of writing in at least one information field may beobtained. The payment instrument images may be obtained from the imagearchive discussed in FIG. 3. The method may further include determiningat least one profile representation of from at least one of theinformation fields.

At least one of the writing profile representations may correspond to atleast one entry type of at least one of the information fields. At leastone variant of the written entry type of an information field may beincluded in the handwriting profile representations.

A “variant” refers to a distinct written sample of a type of writteninformation such as a character or set of characters. A type of writteninformation may be, for example, a letter of an alphabet or a signature.Generally, writing of an writer, such as an individual, includes writingcharacteristics and patterns, data content, and/or semantic patternsthat are unique to the writer. A single sample of an individual'shandwriting, for example, may not include all the unique properties ofthe handwriting of an individual. A single variant includes at leastsome of such properties. Variants of a particular type of writteninformation, such as a signature, may include a majority of the writingcharacteristics and patterns, data content, and/or semantic patternsthat are unique to the individual. For example, an individual mayconsistently include a set of strokes in his or her signature. However,the individual may not include all such strokes in every signaturesample.

Furthermore, a method of assessing fraud in a document, such as apayment instrument, may include performing one or more fraud tests. Adocument may be fraudulent if at least some of the writing on thedocument was not entered by authorized writers permitted to make entrieson a document, such as one or more account owners of a paymentinstrument account. A document may also be fraudulent if at least someof the pre-printed information on the document does not approximatelymatch the pre-printed information in a pre-printed information profile.Fraud tests may include analyses of writing characteristics andpatterns, data content, and/or semantic patterns of entries inindividual information fields and between information fields of adocument such as a payment instrument. FIG. 6 depicts a flow chart of amethod for assessing fraud in a document. Assessing fraud in a documentmay include providing a document to computer system, as shown at step500. Fraud tests may then be performed, as indicated at step 502, on oneor more of the information fields of the document. At step 504, themethod may include assessing whether the payment instrument ispotentially fraudulent based on the results of the one or more fraudtests.

In an embodiment, a fraud test may include an assessment of whetherinformation in an information field of the document approximatelymatches a writing profile or pre-pre-printed information profile (orpayment instrument account profile) of the information field. Failure ofinformation in an information field to approximately match a writingprofile may be evidence that the information was not made by at leastone of the authorized writers permitted to make entries on the document(such as an account owner of a payment instrument account). Matchinginformation in an information field with a profile may refer tocomparing the information as a whole to the profile. Matching aninformation may also refer to comparing discrete elements orcharacteristics of the information to the profile. Therefore, matchingmay include a subset of several fraud tests. In one embodiment, a fraudtest may include analyzing variations among discrete elements ininformation in an information field. Similarly, a fraud test may includeanalyzing a comparison of information in different information fields.Another fraud test may include analyzing correlations of information indifferent information fields. In addition, a fraud test may includeassessing whether information in an information field approximatelymatches a lexicon associated with the information field.

The result of the fraud tests may provide evidence that a document, suchas a payment instrument, is potentially fraudulent. The strength of theindication of fraud may be different for each fraud test. In oneembodiment, one or more of the fraud tests may be assigned a fraudweight, such that the fraud weight corresponds to the strength of theindication of fraud in the payment instrument. An assessment of whethera document, such as a payment instrument, is fraudulent may be based onone or more of the fraud tests and the corresponding fraud weights. Theassessment may be made in the fraud detector depicted in FIG. 3.

In an embodiment, when a fraud test indicates fraud, the computer systemmay generate a flag indicating that the document is potentiallyfraudulent. The flag may include a fraud weight that corresponds to astrength of the indication of fraud of the fraud test. The fraud weightof a fraud test may depend on a number of factors. For example, fraudtests involving features that are consistently present in certaindocuments, such as payment instruments of an account, may receive agreater weight than fraud tests involving features present lessfrequently. For example, variations in writing features that are alwayspresent may receive a higher weight than variations in features that areinfrequently present. In addition, fraud tests involving fields wherefraud is frequently perpetrated in payment instruments, such as acourtesy amount field and a legal amount field, may receive a higherweight than fraud tests relating to other information fields.

TABLE 1 Summary of Content in a Document Profile and CorrespondingAnalysis Techniques. Profile Component Content Analysis TechniqueInformation Field Mathematical representations for Information FieldContent Shape variants of types of written Content Shape Analysisinformation Information Field Images for variants of types of writtenInformation Field Content Image information Content Image AnalysisDigit/Alpha Mathematical representations for Digit/Alpha Analysisvariants of a letter type and a numeral type Symbology Mathematicalrepresentations for Symbology Analysis variants of a symbol type Imagesfor variants of a symbol type Syntax Pattern Elements and ordering ofelements in Syntax Pattern Analysis specific information fields LexiconList of the names that have previously Lexicon Analysis been recognizedon documents associated with a set of individuals and/or accountsDocument Stock or Representation of the nature and Document AnalysisPre-printed location of the graphic elements and Informationmachine-printed text that appear on a document associated with a set ofindividuals and/or accounts Mathematical representations for variants oftypes of pre-printed information, including font type, informationImages for variants of types of machine-printed information, includingfont type Information Field Table listing the cross field Cross FieldMatching Cross Correlation relationships of interest in a documentAnalysis associated with a set of individuals

Table 1 provides a summary of components of content (i.e., variablewriting and pre-printed information) in a document profile, such as apayment instrument account profile, and analysis techniques according toone embodiment. The analysis techniques may be applied to thecorresponding profile contents to assess fraud in a document such as apayment instrument. The information field content shape profile mayinclude mathematical representations for variants of types of writteninformation. The information field content image profile may includeimages for the variants of types of written information. The writingprofiles may include representations of at least one font style ofmachine-printed writing. The digit/alpha profile may include bothmathematical representations and images for the variants of characterssuch as letters and numerals. The symbology profile may includemathematical representations and images of variants of symbols thatappear in the information field of a document such as a paymentinstrument (e.g., a ‘+’ in the legal amount field). The syntax patternprofile may include a list with elements and an order of the elements inspecific information fields. For example, a syntax pattern profile mayinclude the variants of the form of a month, day, year, and punctuationand the order of the month, day, and year and punctuation in the datefield. In addition, the lexicon profile may include a list of names thathave previously been recognized for an account in a particularinformation field, such as payee names in a payee field. The documentstock or pre-printed profile may include representations of pre-printedinformation such as graphic elements (e.g., bank logos) andmachine-printed text (e.g., name and address of account owners) thatappear on a document, such as a payment instrument. The document stockprofile may also include mathematical representations and/or images ofmachine-printed text. The information field cross correlation profilemay include a list of cross field relationships that may occur with aparticular frequency in a document associated with particular writers,such as in a payment instrument of an account. For example cross fieldrelationships may include: account number in a memo field to payee name,payee name to legal and courtesy amount, and identity of check writerfrom the signature field to syntax patterns and symbology in otherfields.

Handwriting and/or writing may include, but is not limited to amathematical representation and/or an image. Handwriting and/or writingmay also include, but is not limited to at least one type of handwrittenand/or written information such as a word type and/or character type.Handwriting and/or writing may further include, but is not limited to aglobal feature of handwriting and/or writing, a local feature ofhandwriting and/or writing, a syntax pattern, and/or a lexicon name foran information field. A handwriting and/or writing profilerepresentation may include, but is not limited to at least one of thetypes of handwriting and/or writing profiles described in Table 1.

TABLE 2 Summary of Content Analysis for Payment Instrument. InformationField Content Analysis Pre-printed Matching of all preprintedinformation including information machine-printed text, logos, line andother graphic elements Font Matching Courtesy Amount Individualcharacter analysis Character patterns surrounding the courtesy amountSymbology used in writing the cents amount Legal Line - Dollar Globalhandwriting features Amount Word matching Individual character analysisSymbology connecting the dollar and cent content Character patternssurrounding the legal amount Legal Line - Cents Punctuation AmountIndividual digits Payee Global writing features Words Individualcharacters Lexicon matching to generic lists of payees (e.g., commonpayees) Lexicon matching to suspicious payees (payee names frequentlyinvolved in transactions with high fraud risk) Matching to ASCII list ofpayees common for the account Matching to handwriting of payees commonfor the account Signature Global writing characteristics Word matchingMemo Global writing characteristics Individual character analysis DatePatterns Individual character analysis Endorsement Matching ofendorsement to payee

Table 2 describes a summary of various embodiments of analysis forinformation fields of a payment instrument. The profiles described inTable 1 may be applied to assess a payment instrument using the analysissummarized in Table 2.

Profile representations of variable writing and pre-printed information(e.g., machine-printed text) may be stored in memory on a computersystem in terms of mathematical representations. In an embodiment, awriting profile, such as a payment instrument account profile, mayinclude one or more mathematical representations of variable writingand/or pre-printed information. The mathematical representations mayinclude one or more variants of an entry type of an information field.As noted above, a variant refers to a distinct version of a type ofwritten information. For example, the appearance of a handwrittensignature of an individual, such as an account owner, may tend to vary,even within a short time period. The account owner may have severaldistinct versions of his or her signature. The one or more mathematicalrepresentations in a signature profile for an account owner correspondto one or more of the variants of the signature. In other embodiments, awriting profile, such as a payment instrument account profile, in memoryon a computer system may include one or more images. In a similarmanner, one or more of the images may include images of one or morevariants of an entry type of an information field.

In one embodiment, mathematical representations of writing may beexpressed as feature vectors. For example, U.S. Pat. Nos. 6,157,731 toHu et al., 6,084,985 to Dolfing et al., 5,995,953 to Rindtorff et al.,5,828,772 to Kashi et al., and 5,680,470 to Moussa et al., which areincorporated by reference as if fully set forth herein, disclose the useof feature vectors to represent handwriting. Feature vectors are vectorsthat may include one or more writing features that characterize writingas elements of the vectors. For example, features included in a featurevector may represent the strokes that make up written information. Sincewriting has a local character and a global character, both localfeatures and global features may characterize writing. Global featuresdescribe general characteristics of writing. Consequently, globalfeatures may be discernible in all information fields of a document suchas a payment instrument. Global features in a profile for an informationfield may be the result of combining global features from writteninformation in several information fields. Global features may includeglobal slant, tangent entropy, global thickness of stroke (penthickness), and curvature entropy.

“Entropy” refers to a way of measuring information content. Somethingthat is very predictable has an entropy of zero, while something havinglittle or no predictability, has maximum entropy. The more predictablewriting appears, the lower its entropy. Handwriting strokes may beparallel or may have several directions. Handwriting that is predictablemay be composed of strokes in relatively regular patterns. On the otherhand, a signature with many vertical and horizontal strokes may havehigher entropy.

Curvature versus tangent entropy refer to a measure of changes in curvesand stroke directions, respectively. The style of writers may beclassified according to their entropies. The entropy, H(i), of stroke imay be calculated by H(i)=−p_(i) log (p_(i)), where p_(i) is theprobability of stroke i.

Local features refer to characteristics specific to a particular writingsample. Local features may include local slant, leading and trailingtail shape and direction, topology of a digit, stroke distribution(e.g., proximity of strokes, height, width), local thickness of stroke(to evaluate shakiness in handwriting), alpha versus numeric patterns(e.g., date), punctuation, symbols, ‘00’ shape in amounts, and ‘xx/100’structures in the legal amount.

Furthermore, topological vectors may represent the relationship betweenstrokes. The topological vectors may include information about thelocation of strokes with respect to one another, for example, tangentand direction vectors.

In an embodiment, one or more of the variants of types of writteninformation of an information field of a writing profile may include amajority of the features that characterize the writing of authorizedwriters, such as one or more account owners. Stable features refer tofeatures that tend to appear consistently in writing in differentsamples of a writer. Stable features may tend to be more significant infraud assessment and recognition than weak features. Weak features referto features that tend not to appear consistently in writing samples.Furthermore, writing in the information fields of a document, such as acheck or giro, may be converted into a mathematical representation.

FIGS. 7, 8, 9, and 10 illustrate features that may be included inmathematical representations of information or entries in informationfields of a payment instrument. FIG. 7 represents nine variations of asignature entry in a signature field. Although some variation exists inthe signature entries, bottom left stroke 364 and top right stroke 366are consistently present. Such features may be considered to be stablefeatures. FIG. 8 represents entries from a payee field. Severalcharacteristics are consistent in each of entries 324-330. For example,the characters tend to be upright with block letters. Also, thecharacter shapes, such as that of the ‘C’, are consistent. FIG. 9represents entries from a courtesy amount field. The courtesy amountentries also exhibit several consistent features. These include thecents ‘00’ and non ‘00’ features, as shown by entries 332 and 334. Digitshapes are also consistent, for example, the ‘4’s, as shown by entries333 and 334 and the ‘2’s, as shown by entries 335 and 336. FIG. 10represents legal amount entries in a legal amount field. The legalamount entries include dollar amount 348, symbol (‘+’) 350, and symbol(‘xx/100’) 349. The dollar amount and symbols are consistent among thevarious entries.

An embodiment of a method of generating a writing profile forinformation fields of a document is depicted by a flow chart in FIG. 11.In an embodiment, one or more of the documents may be a paymentinstrument. The information fields may include handwriting of one ormore account owners of a payment instrument account. The method mayinclude providing one or more documents to the computer system, as shownin step 526 of FIG. 11. In one embodiment, at least one of the documentsmay include at least one information field. In other embodiments, atleast one of the documents may include at least two information fields.One or more of the documents may be provided by accessing at least oneimage from a database in memory on a computer system. At least one ofthe documents may be a valid document. In certain embodiments, themethod may include obtaining images of writing in the informationfields. The method may further include determining at least one writingprofile representation for at least two information fields, as shown instep 528. Determining at least one writing profile representation mayuse writing from at least one of the information fields of thedocuments. At least one of the writing profile representations may bestored on a memory medium on a computer system.

In an embodiment, at least one writing profile representation may beassessed for at least two of the information fields using writing fromat least one of the information fields. Alternatively, at least twowriting profile representations may be assessed. In some embodiments,writing may be used from at least two information fields.

In other embodiments, at least two writing profile representations maybe assessed for at least one of the information fields using writingfrom at least one of the information fields. Alternatively, at least twowriting profile representations may be assessed for at least one of theinformation fields. In some embodiments, writing may be used from atleast two information fields.

In some embodiments, at least one writing profile representation may beassessed for at least one of the information fields using handwritingfrom at least two of the information fields. Alternatively, at least twowriting profile representations may be assessed. In another embodiment,at least one writing profile representation may be assessed for at leasttwo of the information fields. Some embodiments may further includedetermining at least two writing profile representations for at leasttwo of the information fields using writing from at least twoinformation fields.

The method may further include determining mathematical representationsof writing in one or more of the information fields. In someembodiments, determining mathematical representations of writing mayinvolve converting images of writing in at least one of the informationfields to mathematical representations.

At least one of the writing profile representations may includemathematical representations of the writing in the information fields.In an embodiment, determining writing profile representations mayinvolve determining variants of the mathematical representations ofwriting. In an embodiment, at least one writing profile representationmay include at least one writing variation (variant) of an example of atleast one type of written information. For example, profilerepresentations, belonging to the Digit/Alpha profile described in Table1, may include variants of the handwritten letter “a.” The writingprofile representations may also include variants of one or more entrytypes in the one or more information fields. In an embodiment, at leastone of the writing profile representations may be an image. In otherembodiments, at least one of the writing profile representations may bea mathematical representation.

The conversion of an image to a mathematical representation expressed asfeature vectors is disclosed in U.S. Pat. Nos. 6,157,731 to Hu et al.,6,084,985 to Dolfing et al., 5,995,953 to Rindtorff et al., 5,828,772 toKashi et al., and 5,680,470 to Moussa et al., which are incorporated byreference as if fully set forth herein. For example, one method mayinclude first converting an image to a runlen image. A “runlen image”refers to a raster scan image that is represented by black (where thetext is) and white runs (where the background is). A runlen image has Nlines (in a raster scan) and each line is represented by a variablenumber of runs (white-black-white-black- . . . ). A run may berepresented by a start point and its length. The runlen image may thenbe converted to a Freeman chain code. A “Freeman chain code” is an imagerepresentation that has an 8-direction code that provides a contour ofan object in an image, for example, a letter. The Freeman chain code maythen be converted to a tangent, which may be converted to curvature. Thecurvature may then be converted to a handwriting or writing stroke.

In an embodiment, one or more variants among the mathematicalrepresentations may be assessed using a clustering algorithm. Clusteringalgorithms are methods of grouping large sets of data into clusters ofsmaller sets of similar data. The goal of a clustering algorithm is toreduce an amount of data by categorizing or grouping similar data itemstogether into a “cluster.” A clustering algorithm finds natural groupsof components (or data) based on some similarity. In particular, aclustering algorithm may determine groups of mathematicalrepresentations based on similarity of writing features. The clusteringalgorithms that assess the variants of a type of written information mayuse curvature and tangent profile matching (entropy measure), dynamicwarping/matching, and K-nearest neighbor techniques.

FIG. 12 is an illustration of determining variants for a handwritingprofile from handwriting samples. Handwriting samples 312 depict sixdifferent samples of a signature from the signature field of a check.The signature samples are very consistent with little variation from onesample to another. Therefore, only one variant may be assessed tocharacterize the signature of the account holder (e.g., variant 318).Handwriting samples 314 depict seven samples from the city field of agiro. There is also little variation in the samples of the city name. Inthis case, variant 320 may be assessed to characterize the city name. Inaddition, handwriting samples 315 depict samples of the payee line of acheck. A small amount of variation is exhibited between the samples.Variant 317 may be assessed to characterize the samples. Handwritingsamples 316 depict seven samples of a legal amount from a check. In thiscase, there are three entry types with respect to the dollar amount:four samples with “one hundred dollars” and one sample each for “two,”“three,” and “four hundred dollars.” Only one variant of the “onehundred dollars” samples may be necessary.

As described herein, a writing profile may be assessed from more thanone sample of writing, as shown in FIG. 12. It is advantageous to base awriting profile on more than one sample due to variations in writing ofthe authorized writers. A greater variation in writing of the authorizedwriters may require a greater number of samples to characterize thewriting with a writing profile.

Variation in handwriting may be both inherent and dynamic. Dynamicvariation refers to the change in an individual's handwriting over time,for example, over months and years. For example, the variation of a datefrom a date field and a signature from checks written over a period ofmonths is illustrated in FIG. 13. Samples 298, 300, 302, 304, and 306represent a variation from May to September of the year 2001. In thiscase, the dynamic variation for both the date and the signature isapparent. The appearance of the signature varies between May andSeptember. In addition, there is a change in the syntax of the datefield from an alphabetic month to a numeric month between May andSeptember.

Inherent variations refer to variations in handwriting that areindependent of time or that may occur over a short period of time, forexample, over days. The source of inherent variations may beinconsistent handwriting of an individual. For instance, an individualmay consistently write a signature two or more ways.

In one embodiment, a method of generating a handwriting profile, such asa payment instrument account profile that takes into account inherentvariations is depicted in FIG. 14. In step 506, one or more documentsmay be provided to a computer system. The documents may be provided froma database corresponding to a document archive shown in FIG. 3. Thedocuments may be valid documents submitted by authorized writers. Thedocuments may take into account variations in the handwriting of theauthorized writers only up to the date of the latest submitted documentin the database. At least one handwriting profile representation may beassessed from one or more of the documents, as shown in step 508. Thehandwriting profile representations may be, for example, images and/ormathematical representations. One or more of the handwriting profilerepresentations may then be stored in memory on a computer system, asshown in step 510. Alternatively, at least one of the handwritingprofile representations may be stored on various types of portablememory media not coupled with a computer system. For example, thehandwriting profile representations may be stored in a handwritingprofile database depicted in FIG. 3.

In an embodiment, a method of generating a handwriting profile on acomputer system that accounts for dynamic variations in handwriting isdepicted in FIG. 15. As shown in step 517, the method may includeproviding one or more documents to the computer system. At least one ofthe documents may include at least one information field. In someembodiments, the documents may include at least two information fields.At least one of the documents may be a valid document, such as avalidated payment instrument. In an embodiment, the one or moredocuments may be provided to the computer system by providing images ofthe document to the computer system. At least one handwriting profilerepresentation may be assessed for at least two of the informationfields using the handwriting from at least one of the informationfields, as indicated at step 518. Alternatively, at least onehandwriting profile representation may be assessed for at least one ofthe information fields using the handwriting from at least two of theinformation fields. In other embodiments, at least two handwritingprofile representations may be assessed for at least one of theinformation fields using the handwriting from at least one of theinformation fields. In an embodiment, the handwriting profilerepresentations may be stored on a memory medium on a computer system.

In some embodiments, the method may further include providing one ormore additional documents to the computer system, a shown by step 519.At least one of the additional documents may include at least oneinformation field. At step 521, the method may include updating at leastone of the handwriting profile representations using at least one of theinformation fields of at least one of the additional documents.Alternatively, updating may also use at least one of the informationfields of at least one of the documents. In certain embodiments,updating at least one of the handwriting profile representations mayinclude modifying at least one handwriting profile representation,deleting at least one handwriting profile representation, and/ordetermining at least one handwriting profile representation.

The additional documents may be payment instruments presented forpayment to a bank that have been validated. The computer system memorymay then be updated with the handwriting profile representationsobtained from the additional documents. Consequently, the profile may beperiodically updated to take into account the dynamic variation of thehandwriting of the one or more account owners.

A writing profile, such as a payment instrument account profile, asdescribed herein, may be applied to assess fraud in documents, such aspayment instruments presented for payment to a bank. Methods forassessing fraud in a document, such as a payment instrument, may requiremethods for recognizing characters or text on a document. “Recognizing,”as used herein, refers to the process of identifying elements of writteninformation, such as numerals, letters, and symbols, from arepresentation of the characters. The representation may be an image ormathematical representation, for example. Elements of writteninformation may be identified from mathematical representations fromfeature vectors.

Written information in an image representation may be identified byconverting the image into a computer processable format, such as ASCII.“ASCII” is an acronym for the “American Standard Code for InformationInterchange.” ASCII is a code for representing English characters asnumbers, with each letter assigned a number from 0 to 127. Most computersystems use ASCII codes to represent text to enable transfer of datafrom one computer to another.

Several products are commercially available for recognition of writteninformation in images. For example, Checkscript and Quickstrokes arecharacter recognition software products from Mitek Systems of San Diego,Calif. In addition, Checkplus 2.0 is character recognition softwareprovided by Parascript of Niwot, Colo. A2iA of New York, N.Y. providesCheckReader™. The Corroborative Image Character Recognition (CICR)System may be obtained from Computer Sciences Corporation of El SegundoCalif. Gaussian Probabilistic Distribution (GPD) software may beobtained from Malayappan Shridhar of the School of Engineering at theUniversity of Michigan at Dearborn, Dearborn, Mich.

In one embodiment, the information field content shape profile, referredto in Table 1, may include at least one mathematical representation ofwriting on a computer system. At least one of the mathematicalrepresentations may represent writing of authorized writers, such as oneor more account owners. In an embodiment, mathematical representationsmay include one or more entry types of an information field of adocument. The mathematical representations characterize writing of theauthorized writers. The mathematical representations may be representedin terms of feature vectors, as described herein. In an embodiment, atleast one of the mathematical representations may include at least onevariant of an entry type of an information field.

According to one embodiment, an information field content shape profilemay be generated for any information field of a document that includeswriting. For example, information field content shape profiles of achecking account (see FIG. 4) may be generated for payee names of apayee field, dates in a date field, amounts in a courtesy amount field,amounts in a legal amount field, descriptions in a memo field, and asignature in a signature field. Additionally, information field contentshape profiles of a giro account (See FIG. 5) may be generated foraccount numbers in a debit account field, amounts in an amount field,descriptions in a description field, account numbers in a credit accountfield, names in a name field, city names in a city field, and signaturesin a signature field.

Fraud may be assessed in a document by comparing written information inan information field of the document to a writing profile, such as apayment instrument account profile. According to one embodiment, amethod of comparing written information to a writing profile using acomputer system may include providing the written information from adocument to the computer system. The written information may be in theform of a mathematical representation that includes one or more samplefeatures. Furthermore, at least one writing profile representation maybe stored in memory on a memory medium. At least one writing profilerepresentation may include at least one mathematical representation. Atleast one mathematical representation may include one or more profilefeatures. In an embodiment, the sample features and the profile featuresmay include both global features and local features.

The method may further include assessing non-matching features from acomparison of the sample features and profile features. In someembodiments, the non-matching features may be associated with fraudweights.

“Match” refers to a degree of similarity between samples of writteninformation. For example, U.S. Pat. Nos. 5,995,953 to Rindtorff et al.,5,828,772 to Kashi et al., and 5,710,916 to Barbara et al., which areincorporated by reference as if fully set forth herein, disclose methodsthat include assessing a degree of similarity between samples ofhandwritten information based on a comparison of the feature vectors ofthe samples of handwritten information.

According to one embodiment, determining whether a sample of writteninformation matches a profile includes both “global matching” and “localmatching” of features. Generally, global matching refers to assessingwhether written information may belong to a set of individuals, such asone or more account owners, based on global characteristics. In globalmatching, global features, such as slant, tangent, and curvatureentropy, in feature vectors of samples may be compared to assess whetherfeatures match. Global matching may be applied, for example, inassessing whether a payee name entry in a payee field and a legal amountentry in a legal amount field were written by the same person.

Furthermore, local matching refers to assessing whether two samples ofwritten information correspond to the same character, word, or set ofwords and characters. Local matching may be applied, for example, inassessing whether a signature was written by an account owner. Thesignature may be compared to writing profile representations ofsignatures of one or more account owners. Local matching may employmathematical techniques such as K-nearest neighbor and neural networks.For instance, in the case of a neural network applied to the legalamount field, a sample of written information and all of the variants of“One Hundred” may be converted into feature vectors. A neural net maythen be trained using a standard back propagation training algorithm toassess whether the sample of written information matches at least one ofthe variants.

In certain embodiments, the writing profile may be used to assess adocument, such as a payment instrument that is presented to a bank forpayment. A method depicted in FIG. 16 of assessing a document mayinclude providing a document to the computer system, as shown at step418. The document may include at least one information field. In anotherembodiment, the document may include at least two information fields.The method may further include comparing writing in at least two of theinformation fields of the document to at least one writing profilerepresentation, as shown at step 420. At least one writing profilerepresentation may be from at least one information field of at leastone other document. In an embodiment, at least the one other documentmay be a valid document. In another embodiment, the method may includecomparing writing in at least one of the information fields of thedocument to at least one writing profile representation from at leasttwo information fields of at least one other document. Alternatively,writing in at least one of the information fields of the document may becompared to at least two writing profile representations from at leastone information field of at least one other document.

As depicted in step 422, fraud in the document may be assessed using atleast one of the comparisons. In some embodiments, evidence of fraud mayinclude a failure of at least a portion of the writing in at least oneof the information fields of the document to approximately match atleast one writing profile representation. Alternatively, evidence offraud may be a failure of at least a portion of the writing in at leasttwo of the information fields of the document to approximately match atleast one writing profile representation.

In certain embodiments, the information field content shape profile maybe used to assess fraud in a document, such as a payment instrument thatis presented to a bank for payment. A method depicted in FIG. 17 mayinclude obtaining at least one mathematical representation of thewriting from information fields of the document, as shown at step 540.In an embodiment, mathematical representations may be obtained byconverting images of the written information. At least one of themathematical representations may correspond to an example of a type ofwritten information and/or an entry type of an information field. Themethod may further include providing access to a computer system thatincludes a writing profile, as shown by step 542. In an embodiment, thewriting profile may include at least one writing profile representationof writing from one or more valid documents. At least one writingprofile representation may correspond to at least one variant of a typeof written information and/or an entry type of an information field. Atstep 544, at least one of the mathematical representations of thehandwriting may be compared to one or more of the handwriting profilerepresentations to assess whether the written information approximatelymatches the profile. If the written information does not approximatelymatch the information field content shape profile, the computer maygenerate a flag indicating that the document is potentially fraudulent.

In one embodiment, the information field content image profile, referredto in Table 1, may include at least one image of writing on a computersystem. At least one of the images may correspond to writing ofauthorized writers, such as one or more account owners. In anembodiment, at least one of the images may correspond to one or moreentry types of an information field of a document. At least one of theimages may characterize the writing of authorized writers, such as theone or more account owners. In an embodiment, at least one of the imagesmay correspond to at least one variant of an example of a type ofwritten information or an entry type of an information field. Accordingto one embodiment, as described in reference to the information fieldcontent shape profile, an information field content image profile may begenerated for at least one information field of a document.

In some embodiments, the information field content image profile may beused to assess fraud in a document, such as a payment instrument that ispresented to a bank for payment. A method depicted in FIG. 18 mayinclude obtaining at least one image of writing from information fieldsof the document, as shown at step 546. At least one image may correspondto examples of types of written information and/or entry types of one ormore of the information fields. The method may further include providingaccess to a computer system that includes a writing profile, as shown bystep 548. In an embodiment, the writing profile may include at least onehandwriting profile representation from one or more documents. At leastone writing profile representation may correspond to at least onevariant of a type of written information and/or an entry type of aninformation field. At step 550, at least one of the images of thewriting may be compared to at least one writing profile representationto assess whether the writing approximately matches the writing profile.If the writing does not approximately match the information fieldcontent image profile, the computer may generate a flag indicating thatthe document is potentially fraudulent.

Assessing a degree of similarity or matching of images of writteninformation may be performed by several methods. These methods determinethe degree of similarity between two images of a type of writteninformation such as a type of character or set of characters, forexample, a signature. U.S. Pat. No. 6,249,604 to Huttenlocher et al.,which is incorporated by reference as if fully set forth herein,discusses one such method based on the technique of dynamic warping.U.S. Pat. No. 6,157,731 to Hu et al., which is incorporated by referenceas if fully set forth herein, describes another such method that useshidden Markov models.

Computer software that determines a degree of similarity of images of atype of written information may be obtained commercially. GlorySignature Verification Software (GSVS) from Glory Ltd. HIMEJI, HYOGO,Japan determines, with a degree of certainty, whether the sameindividual wrote two images of a type of handwritten information.

FIGS. 18 and 19 illustrate assessment of fraud in the signature field ofa giro. In FIG. 19, illustrations 438 include a set of samples ofhandwritten information that correspond to handwriting profilerepresentations for the signature field of a giro account. The samplesof handwritten information may be stored as mathematical representationsin an information field content shape profile. Alternatively, thesamples of handwritten information may be stored as images in aninformation field content image profile. Samples 440, 442, 444, and 446are signatures from different giros. A comparison of samples 440-446 tothe profile representations 438 may indicate that it is likely that eachof the samples is fraudulent.

Furthermore, in FIG. 20 illustrations 448 include a set of samples ofhandwritten information that correspond to profile representations forthe signature field of another giro account. Sample 450 is a signaturefrom a giro. Sample 450 may likely be assessed to be a fraudulentsignature based on a comparison with illustrations 448.

FIG. 21 is an illustration of fraud assessment in the courtesy amountfield of a check of a checking account. Samples 452 represent entries ina courtesy amount field from valid checks of the checking account.Sample 454 represents a courtesy amount field of a check to bevalidated. Information field content shape analysis may likely flagsample 454 as potentially fraudulent due to the raised ‘00’ and thestyle of the ‘5.’

FIG. 22 is an illustration of fraud assessment in a giro. In FIG. 22,the pen thickness of the signature in signature field 436 issignificantly thinner than the entries in the other fields, for example,amount field 434. Therefore, the giro may likely be flagged aspotentially fraudulent.

FIG. 23 is an illustration of fraud assessment in the city field of agiro. Samples 456 are entries for a city field from valid giros of anaccount. Information field content shape analysis may recognize sample458 as the same city as the entries in samples 456. However, informationfield content shape analysis may likely demonstrate that the handwritingis different than the valid entries. As a result, the giro may likely beflagged as potentially fraudulent.

In one embodiment, the digit/alpha profile, referred to in Table 1, mayinclude one or more sets of written characters on a computer system. Theone or more sets may correspond to one or more character types. Inaddition, the one or more character types may correspond to one or moretypes of numerals. The one or more character types may also correspondto one or more types of letters of an alphabet. A set of writtencharacters may include at least one variant of a written character type.The variants of a character type may characterize the writing featuresof the character type of authorized writers, such as one or more accountowners. For example, a set of handwritten ‘3’s may represent variationsin the way an account owner writes a ‘3.’ In an embodiment, the writtencharacters in the one or more sets may be stored as mathematicalrepresentations, as described herein, on a memory medium. Alternatively,the written characters in the one or more sets may be stored as images.

In certain embodiments, the digit/alpha profile may be used to assessfraud in a document, such as a payment instrument that is presented to abank for payment. A method depicted in FIG. 24 may include obtaining oneor more samples of the writing, as shown at step 552. One or more of thesamples may include one or more images. In an embodiment, thehandwriting in the information fields may include one or more writtencharacters. The method may further include, as shown by step 554,recognizing one or more written characters in one or more images of thewriting in the information fields. The written characters may correspondto at least one character type. The method may further include providingaccess to a computer system that includes a writing profile, as shown bystep 556. In an embodiment, the writing profile may include one or morewriting profile representations from at least one other documents. Theat least one other document may be a valid document. In an embodiment,the one or more writing profile representations may include at least onevariant of a type of written character. At step 558, one or more of thewritten characters may be compared to at least one profilerepresentation of written characters to assess whether the writtencharacters approximately match the writing profile. If one or more ofthe written characters do not approximately match the digit/alphaprofile, the computer may generate a flag indicating that the documentis potentially fraudulent.

In an alternative embodiment, the method may include converting one ormore of the images of the written information to one or moremathematical representations, as described herein. The one or moremathematical representations may include one or more mathematicalrepresentations of written characters. One or more written charactersmay be recognized from the one or more mathematical representations. Themethod may further include comparing the mathematical representations ofwritten characters to at least one writing profile representation ofwritten characters to assess whether the written charactersapproximately match the writing profile.

FIG. 25 is an illustration of converting a character in a handwritingimage to a mathematical representation. Set of images 352 representseveral variations of a handwritten ‘3.’ At step 354, the character maybe recognized using character recognition software. The strokes of thecharacter may then be analyzed at step 356. In this case, the numeral‘3’ includes two strokes: upper cusp 360 and lower cusp 362. The shapeof the character may be classified at step 358 using neural net ork-nearest neighbor techniques.

FIG. 26 illustrates assessment of fraud in a numeric information fieldof a payment instrument using the methods described herein. List 400includes a digit/alpha profile for a payment instrument account fornumeric characters from zero to nine. The profile includes variants ofthe account for each numeric type. Sample 402 corresponds to a numericentry from a field of a payment instrument. Numerals 404 were recognizedas the numeral ‘8’ in the sample. The ‘8’s do not appear to match thevariants 406 of the numeral ‘8’ in the profile.

In one embodiment, the symbology profile, referred to in Table 1, mayinclude one or more written symbols on a computer system. The one ormore written symbols may correspond to one or more symbol types. Forexample, the one or more symbol types may include, for example, one ormore types of punctuation marks and/or a ‘+’. At least one of thewritten symbols may include at least one variant of a type of writtensymbol. The variants of a symbol type may characterize the writingfeatures of the symbol type of designated individuals, such as one ormore account owners of a payment instrument account. For example, one ormore handwritten ‘+’s represent variations in the way an account ownermay write a ‘+’ in the legal amount field. In an embodiment, the writtensymbols in the symbology profile may be stored as mathematicalrepresentations, as described herein, on a memory medium. Alternatively,the written symbols in the symbology profile may be stored as images.FIG. 10 illustrates symbology in handwriting samples in the legal amountfield. The symbol types in the legal amount field include symbol 350, a‘+’, and symbol 349, ‘00/100’.

In certain embodiments, the symbology profile may be used to assessfraud in a document, such as a payment instrument that is presented to abank for payment. A method depicted in FIG. 27 may include obtaining oneor more samples of the writing, as shown at step 560. One or more of thesamples may include one or more images. In an embodiment, the writing inthe information fields may include one or more written symbols. Themethod may further include, as shown by step 562, recognizing one ormore written symbols in one or more images of the writing in theinformation fields. The written characters may correspond to one or moresymbol types. The method may further include providing access to acomputer system that includes a writing profile, as shown by step 564.In an embodiment, the writing profile may include one or more writingprofile representations from one or more documents. In an embodiment,one or more of the handwriting profile representations may include atleast one variant of types of written symbols. At step 566, one or moreof the written symbols may be compared to one or more of the writingprofile representations of written characters to assess whether thewritten symbols approximately match the profile. If one or more of thewritten symbols do not approximately match the symbology profile, thecomputer may generate a flag indicating that the document is potentiallyfraudulent.

In an alternative embodiment, the method may include converting one ormore of the images of the writing to one or more mathematicalrepresentations, as described herein. One or more of the mathematicalrepresentations may include one or more mathematical representations ofwritten symbols. One or more written symbols may be recognized from oneor more of the mathematical representations. The method may furtherinclude comparing the mathematical representations of written symbols toone or more of the writing profile representations of written symbols toassess whether the written symbols approximately match the profile.

FIG. 28 is an illustration of assessment of fraud for a check of achecking account. Sample 392 represents an entry in a legal amount fieldof a check to be validated. Samples 394 represent entries in the legalamount field from valid checks from the checking account. Sample 392 maybe determined to be potentially fraudulent by the methods describedherein. First, information field content shape analysis may demonstratethat the writing of the dollar amount of sample 392 does not matchsamples 394. In addition, there are several differences in symbology.For example, line 391 is different than line 393. The ‘xx/100’ symboldiffers as shown by comparing symbol 397 and symbol 399. Samples 394include line 395, which is absent from sample 392.

In one embodiment, the syntax pattern profile, referred to in Table 1,may include at least one syntax pattern. A syntax pattern may includeone or more elements. The one or more elements in a syntax pattern maybe in a specific order. For example, the entries in the date field of acheck may include a month of the year, a date of the month, a year, andpunctuation marks. At least one syntax pattern in the writing profilemay include at least one variant of a syntax pattern for an informationfield. For instance, at least one variant may be the manner that one ormore account owners enter a date in the date field. For example, a datemay be written several ways: 2/14/01, 2-14-01, Feb. 14, 2001, and 14February 2001. According to one embodiment, elements of the date fieldmay include: a numeric month, an alphabetic month, a numeric date of themonth, a two-digit year, a four-digit year, a comma, a forward slash,and a dash.

In one embodiment, the syntax pattern profile may be used to assessfraud in a document, such as a payment instrument that is presented to abank for payment. A method depicted in FIG. 29 may include obtainingwritten information in an information field, as shown at step 568. Thewritten information may include one or more elements. In someembodiments, the written information may be an image and the method mayinclude recognizing one or more of the elements in the image. One ormore of the elements may include, for example, written characters andsymbols that may appear in the date field of a payment instrument.Alternatively, the written information may be a mathematicalrepresentation, as described herein, and the method may includerecognizing one or more of the elements from the mathematicalrepresentation. An order of one or more of the elements in theinformation field of the document may then be assessed, as shown by step570. The method may further include, as shown by step 572, providingaccess to a computer system that includes a writing profile. Thehandwriting profile may include one or more writing profilerepresentations of writing from one or more valid documents. In anembodiment, the information field may be a date field and the writingprofile representations may include variants of a syntax pattern, suchas a written date. The method may further include comparing the elementsand the order of the one or more elements to one or more writing profilerepresentations to assess whether the elements and the order of the oneor more elements approximately match the writing profile, as shown bystep 574. If the elements and the order of the elements do notapproximately match the syntax pattern profile, the computer maygenerate a flag indicating that the payment instrument is potentiallyfraudulent.

FIG. 30 illustrates fraud assessment in a date field of a paymentinstrument. Samples 388 include several examples of a date field frompayment instruments for an account. The date field for the accountalmost consistently appears as an alphabetic month, followed by anumeric day, and a two-digit year. Date 389 is the only sample that isinconsistent. Sample 390 is a date field from a payment instrument to betested for fraud. The syntax pattern of sample 390 approximately matchesonly date 389 of samples 388. In addition, the slant of sample 390 doesnot match date 389. Therefore, sample 390 may be potentially fraudulent.

In one embodiment, the lexicon profile, referred to in Table 1, mayinclude one or more lexicon names for an information field of adocument, such as a payment instrument. A lexicon name refers to aspecific word or set of characters or symbols that has been previouslyrecognized in documents associated with authorized writers, such as oneor more account owners of a payment instrument account. In oneembodiment, the list of lexicon names may be stored in memory in acomputer processable format such as a ASCII format. For example, lexiconnames for a payee field may include payee names that have previouslyappeared on checks of a checking account. Another example may includelexicon names for the city field of a giro account. In one embodiment,the lexicon profile may include a frequency associated with a lexiconname. The frequency may be a measure of the how often a lexicon nameappears on a payment instrument of the account. The frequency may beexpressed as a percentage of payment instruments associated with one ormore of the lexicon names over a particular time period. For example, alexicon name for a payee field may have appeared on 21% of checkswritten over a six month period. In some embodiments, a frequency may beassociated with a subset of the lexicon names for an information field.For instance, a frequency may be associated with the top ten payee namesthat appear on payment instruments of the account.

In certain embodiments, the lexicon profile may be used to assess fraudin a document, such as a payment instrument that is presented to a bankfor payment. A method for assessing fraud is depicted in FIG. 31. In anembodiment, a method of assessing fraud in a document using a computersystem may include obtaining writing in an information field of thedocument, as shown in step 576. The method may further includerecognizing an entry from the written information in the informationfield of the document, as indicated in step 578. The entry may includeone or more characters or symbols. The information field may be, forexample, a payee field of a check and the entry may be a payee name.Alternatively, the field may be the city field of a giro and the entrymay be a city name. The method may further include, as shown by step580, providing access to a computer system that includes a writingprofile. The writing profile may include one or more lexicon names forone or more information fields from one or more valid documents. In anembodiment, the method may also include comparing the entry to one ormore of the lexicon names for the information field in the writingprofile to assess whether the entry matches the writing profile, asshown in step 582. If the entry does not approximately match the writingprofile, the computer may generate a flag indicating that the documentis potentially fraudulent.

In some embodiments, the method may include determining a frequencyassociated with the entry if the entry approximately matches at leastone of at least one of the lexicon names. If the frequency is below acertain level, the computer may generate a flag indicating that thepayment instrument is potentially fraudulent. In another embodiment, themethod may include assessing whether the entry is a member of a subsetof lexicon names that are associated with a particular frequency. If theentry is not a member of the subset, the computer may generate a flagindicating that the document is potentially fraudulent.

FIG. 32 illustrates fraud assessment in a city field of a giro. Samples428 represent variants of the city name “Bunschoten” for a city field ofa giro account. An information field content shape or information fieldcontent image profile may include samples 428. Sample 430 is an entry ina city field of a giro. Sample 430 does not appear to approximatelymatch samples 428 and was recognized as “Bilthoven.” Lexicon 432represents a lexicon profile that includes a list of city names thathave previously appeared on giros of the account. Each city nameincludes a number in parenthesis indicating the number of giros on whichthe city name has appeared. Sample 430 also appears to fail toapproximately match the lexicon profile. Therefore, the giro may bepotentially fraudulent.

FIG. 33 is an illustration of fraud assessment in the memo field of agiro of a giro account. List 464 represents a list of entries thatappeared in the memo field of valid giros of a giro account. List 464may correspond to a lexicon profile. Sample 466 is an entry in the memofield of a giro to be validated. A comparison of sample 466 with thelist indicates the sample is not consistent with the account. Therefore,the giro is potentially fraudulent.

In some embodiments, the information field cross correlation profile,referred to in Table 1, may include cross-field relationships for adocument, such as a payment instrument account on a computer system. Inparticular, a writing profile may include one or more first lexiconnames associated with a first information field of a payment instrumentof the account on a computer system. At least one of one or more of thefirst lexicon names may be associated with one or more second lexiconnames associated with a second information field. The first lexicon namemay include an entry type of the information field and the secondlexicon name may include an entry type of the second information field.The cross-field relationships in the writing profile may includerelationships between information fields that occur with a particularfrequency in a document, for example, in payment instruments of anaccount. In this manner, an entry in one information field may be usedto predict a likely entry type in another information field. In oneembodiment, a frequency of a particular cross-field correlation in anaccount may be included in the profile.

Several types of relationships between information fields may occurfrequently in payment instrument accounts. For example, a particularaccount number entered in a memo field may be correlated with a payeename in the payee field of a check. Also, a payee name may be correlatedwith a particular courtesy amount. In addition, the identity of oneaccount owner of a joint account, obtained from the signature field, maybe correlated with a syntax pattern in the date field.

In certain embodiments, the information field cross correlation profilemay be used to assess fraud in a document, such as a payment instrumentthat is submitted to a bank for payment. A method for validating apayment instrument is depicted in FIG. 34. The method may includeassessing whether a first entry in a first information fieldapproximately matches one or more first lexicon names in a handwritingprofile for the first information field, as shown by step 584. Themethod may further include, as shown by step 586, obtaining writing in asecond information field of the document. Access may then be provided tothe computer system that includes a writing profile, as shown by step588. The handwriting profile may include cross-field correlations fromone or more valid documents. The method may further include comparingthe second entry to a second lexicon name of one or more second lexiconnames associated with the approximately matching first lexicon name inthe first information field. The comparison may be used to assesswhether the second entry approximately matches a second lexicon name, asshown by step 590. If the second entry does not match a second lexicon,the computer may generate a flag indicating that the document may bepotentially fraudulent. In another embodiment, the frequency that thefirst lexicon name approximately matches the second lexicon name may beconsidered in fraud assessment of the document.

An embodiment of a method of assessing information in at least oneinformation field in a document is depicted by a flow chart in FIG. 35.In an embodiment, one or more of the documents may be a paymentinstrument. The information fields may include writing of one or moreaccount owners of a payment instrument account. The method may includeproviding a document to the computer system, as shown in step 598 ofFIG. 35. In one embodiment, the documents may include at least oneinformation field. In other embodiments, the document may include atleast two information fields. The document may be provided by accessingat least one image from a database in memory on a computer system. Incertain embodiments, the method may include obtaining information onwriting in an information field of the document, as shown in step 600.In some embodiments, obtaining information on writing may includerecognizing written information in an information field. For example, apayee name in a payee field of a payment instrument may be recognized.

As shown in step 602, the method may further include comparing theobtained written information in the information field and writteninformation in at least one other information field to at least onewriting profile representation from at least one other document.Alternatively, the obtained written information in the information fieldand written information in at least two other information fields may becompared to at least one handwriting profile representation from atleast one other document. In other embodiments, the method may includecomparing the obtained written information in the information field andwritten information in at least one other information field to at leasttwo writing profile representations from at least one other document.

In an embodiment, at least one of the other documents may be valid. Incertain embodiments, at least one of the writing profile representationsmay include written information from the information field and writteninformation from at least one of the other information fields. Thewritten information from the information fields may be from at least oneof the other documents. For example, at least one writing profilerepresentation may include a cross-field correlation between theinformation field and at least the one other information field. In oneembodiment, the cross-field correlation may include a lexicon name forthe information field and at least one lexicon name for at least the oneother information field.

In some embodiments, at least one of the comparisons of writteninformation may be used to verify the obtained written information, asshown in step 604. In one embodiment, written information may beverified by assessing whether the obtained written information in theinformation field and the written information in at least one otherinformation field approximately matches at least one writing profilerepresentation from at least one other document.

In some embodiments, the document stock or pre-printed profile, referredto in Table 1, may include one or more stock characteristics orpre-printed information of a document associated with authorizedwriters, such as one or more account owners. For example, the stockcharacteristics may characterize a layout of the payment instrumentcorresponding to the account. Stock characteristics may include one ormore graphics elements, as well as their location, on the paymentinstrument of the account. Graphics elements may include, for example,bank logos. The size of the payment instrument of the account may alsobe a stock characteristic. In addition, stock characteristics mayinclude one or more machine-printed text blocks, along with theirlocations. Text blocks may include, for example, an address of one ormore account owners and account numbers. The document stock profile mayinclude a machine-printed profile analogous to a variable writingprofile for information fields. The machine-printed profile may includemathematical representations and/or images of machine-printed text inthe text blocks of documents.

FIG. 36 depicts stock characteristics of a check 340. Label 338indicates graphics elements that consist of logos. Label 342 indicatesan account/routing order number. In addition, label 344 is the name andaddress of the account owner.

In certain embodiments, a pre-printed profile may be used to assess adocument, such as a payment instrument that is presented to a bank forpayment. A method depicted in FIG. 37 of assessing a document mayinclude providing a document to the computer system, as shown at step530. The document may include at least one information field. In anotherembodiment, the document may include at least two information fields.The method may further include comparing pre-printed information in atleast two of the information fields of the document to at least onepre-printed profile representation from at least information field of atleast one other document, as shown in at step 532. In an embodiment, atleast the one other document may be a valid document. In anotherembodiment, the method may include comparing pre-printed information inat least one of the information fields of the document to at least onepre-printed profile representation from at least two information fieldsof at least one other document. Alternatively, pre-printed informationin at least one of the text blocks of the document may be compared to atleast two pre-printed profile representations from at least one textblock of at least one other document.

Pre-printed information may include, but is not limited to amathematical representation and/or an image. Pre-printed information mayalso include, but is not limited to at least one type of pre-printedinformation such as a word type, character type and/or graphic element.Pre-printed information may further include, but is not limited to aglobal feature of pre-printed information and a local feature ofpre-printed information.

As depicted in step 534, fraud in the document may be assessed using atleast one of the comparisons. In some embodiments, potential fraud maybe indicated by a failure of at least a portion of the pre-printedinformation in at least one of the information fields of the document toapproximately match at least one pre-printed profile representation.Alternatively, potential fraud may be indicated by a failure of at leasta portion of the pre-printed information in at least two of theinformation fields of the document to approximately match at least onepre-printed profile representation.

FIG. 38 illustrates fraud assessment in a giro. Text 424 representsmachine-printed text that is a stock characteristic from a giro of anaccount. Text 425 and 426 represent the corresponding machine-printedtext from giros presented for payment. The size of text 424 is 260pixels×80 lines. Text 425 and 426 have a size of 350 pixels×95 lines.The inconsistency may indicate potential fraud.

In certain embodiments, fraud may be assessed from variances in writingwithin an information field of a document, such as a payment instrument.Variances may occur when a forger alters a specific portion of adocument, such as a payment instrument. For example, a forger may alterthe amount in the courtesy amount field by writing in one or moreadditional numbers. Therefore, an information field may contain writtencharacters of the same type written both by a forger and by designatedindividuals, such as one or more of the account owners.

FIG. 39 depicts an embodiment of a method of assessing a document, suchas a payment instrument using a computer system. The method may includeproviding a document to a computer system, as shown in step 592. In anembodiment, the document may include at least one information field. Insome embodiments, writing in at least one of the information fields ofthe document may include at least two examples of a type of writteninformation. Writing may include, but is not limited to types ofcharacters, words, symbols, and/or other writing features. Other writingfeatures may include, but are not limited to local slant, global slant,or pen thickness. For example, written characters may include one ormore character types, as described herein. An information field mayinclude written characters of the same character type. For instance, acourtesy amount field of a payment instrument may read ‘3,740.53.’ Thiscourtesy amount field includes two examples of a type of writteninformation, the first ‘3’ and the second ‘3.’ In some embodiments, thewriting may include an image. Alternatively, the writing may include amathematical representation. In an embodiment, examples of types ofwritten information may be recognized from an image and/or amathematical representation.

The method may further include, as shown by step 594, comparing at leasttwo of the examples of the type of written information. At step 596, themethod may additionally include assessing whether two or more of theexamples approximately match. In the case cited above, the first and thesecond ‘3’ may be compared to assess whether they match. One embodimentmay include comparing images of examples of a type of writteninformation with image comparison software. Alternatively, examples of atype of written information may be converted to mathematicalrepresentations. In this case, the handwriting features of themathematical representations may be compared. If at least two of theexamples of written information do not approximately match, the computermay generate a flag indicating that the document may be potentiallyfraudulent.

In some embodiments, the method may further include comparing theexamples of types of written information to at least one writing profilerepresentation. For example, examples of types of handwritten charactersmay be compared to writing profile representations in the digit/alphaprofile.

Some embodiments may include a method of assessing fraud from variancesin writing between different information fields of a document. In oneembodiment, a document may include at least two information fields. Atleast two information fields of the document include at least oneexample of a type of written information. The method may includecomparing at least two of the examples in at least two of theinformation fields. The method may further include assessing whether twoor more of the examples approximately match. For instance, numerals in adate field and numerals in a courtesy amount field of a paymentinstrument may be compared. For example, a courtesy amount field mayread ‘3,340.53.’ A date field of the same payment instrument may read‘Jan. 4, 2003.’ Both the courtesy field and the date field includeexamples of a written ‘4,’ which may be compared. If at least two of theexamples of the type of written information do not approximately match,the computer may generate a flag indicating that the document may bepotentially fraudulent.

FIG. 40 is an illustration of assessing fraud from variations inhandwriting in the same information field and between differentinformation fields of a giro. FIG. 40 a depicts amount field 372 andcredit account field 374 from a giro. Two apparent differences may beassessed between the two information fields. First, there is adifference in ink thickness between information fields. Second, there isa difference in the style of the ‘6’ between the two information fields.

FIG. 40 b depicts amount field 376 and credit account field 378 from agiro. There is a difference in style between the two ‘5’s in the accountfield. In addition, there is a difference in style of the ‘2’ is theamount field and the ‘2’ in the account field.

FIG. 40 c depicts amount field 380 and credit account field 382 from agiro. Variations exist in ink thickness for digits in the account field.In addition, there is a variation in slant for digits in the accountfield. Also, a difference in style is exhibited for the ‘3’ and ‘5’between the amount and account fields.

FIG. 40 d depicts amount field 384 and credit account field 386 from agiro. There are differences in style for the ‘7’, ‘2’, and ‘4’ betweenthe amount and account field. In addition, there is a variation in slantbetween digits in the account field.

In one embodiment, a handwriting profile, such as a payment instrumentaccount profile, may include a database of previously identifiedforgers. The database may further include a forger writing profile forone or more identified forgers. The forger writing profile is analogousto the writing profile for authorized writers, such as one or moreaccount owners, shown in Table 1. A forger profile may include at leastsome writing profile information obtained from previously identifiedforged documents, such as payment instruments, associated with a forger.

FIG. 41 depicts an embodiment of a method for identifying a documentcomprising forged information using a computer system. The method mayinclude providing a document to the computer system, as shown by step612. In one embodiment, the document may include at least oneinformation field. In another embodiment, the document may include atleast two information fields. As shown at step 614, the method mayfurther include comparing writing in at least two of the informationfields of the document to at least one forger writing profilerepresentation from at least one information field. In anotherembodiment, the method may include comparing writing in at least one ofthe information fields of the document to at least one forger writingprofile representation from at least two information fields of at leastone forged document. In some embodiments, writing in at least one of theinformation fields of the document may be compared to at least oneforger writing profile representation from at least two informationfields of at least one forged document

Additionally, as shown at step 615, the method may include identifyingthe document as a document comprising forged information from anapproximate match of at least one forger writing profile representationwith writing in the document. The method may further include identifyingthe forger of the document from the forger writing profile if thedocument is identified as forged, as indicated by step 616.

For many financial services companies keying labor represents a largedata capture cost. For example, one of the most expensive keyingoperations is the keying of data from a written information field, suchas a payee name. Keying labor may be reduced through application of awriting profile, such as a payment instrument account profile. Aprofile, as described in Table 1, may be used to capture writteninformation in information fields of documents, such as paymentinstruments presented for payment.

FIG. 42 depicts an embodiment of a method of capturing writteninformation from an information field of a document using a computersystem. The method may include providing a document to the computersystem, as shown by step 618. In one embodiment, the document mayinclude at least one information field. In one embodiment, the documentmay include at least two information fields. The method may furtherinclude assessing whether writing in an information field approximatelymatches a writing profile representation from at least one informationfield from at least one other document, as indicated by step 620. In anembodiment, the matching writing profile representation is associatedwith a corresponding text representation. In some embodiments, the textrepresentations may be stored in memory in a computer processable formaton the computer system. For example, the computer processable format maybe ASCII format. As shown by step 622, the information field may then beassociated with the text representation corresponding to the matchingwriting profile representation. The writing in the information field maybe a mathematical representation, as described herein. The matching textrepresentation may be assessed from features included in writing profilerepresentations that include mathematical representations from thewriting profile.

FIG. 43 illustrates the capture of an entry in an information field of apayment instrument. Samples 368 represent entries in payee fieldsextracted from valid checks. The entries may be included in a checkingaccount profile and may be stored as mathematical representations.Sample 370 is an entry in a payee field of a check is to be captured.Sample 370 may be identified as “NORTHGATE HIGH SCHOOL” from thehandwriting features in the mathematical representations in samples 368.

Further modifications and alternative embodiments of various aspects ofthe invention may be apparent to those skilled in the art in view ofthis description. Accordingly, this description is to be construed asillustrative only and is for the purpose of teaching those skilled inthe art the general manner of carrying out the invention. It is to beunderstood that the forms of the invention shown and described hereinare to be taken as the presently preferred embodiments. Elements andmaterials may be substituted for those illustrated and described herein,parts and processes may be reversed, and certain features of theinvention may be utilized independently, all as would be apparent to oneskilled in the art after having the benefit of this description of theinvention. Changes may be made in the elements described herein withoutdeparting from the spirit and scope of the invention as described in thefollowing claims.

1. A method of identifying a document comprising forged informationusing a computer system, comprising: providing the document to thecomputer system, wherein the document provided to the computer systemcomprises one or more signature information fields and one or morenon-signature information fields; the computer system comparinghandwriting in at least two of the information fields of the documentprovided to the computer system to one or more forger writing profilerepresentations from one or more signature information fields of atleast one document comprising forged information associated with a knownforger and from one or more non-signature information fields of the atleast one document comprising forged information associated with theknown forger, wherein comparing handwriting in the at least twoinformation fields comprises: the computer system comparing handwritingin at least one of the signature information field of the documentprovided to the computer system to handwriting from at least onesignature information field of the document comprising forgedinformation associated with the known forger in at least one forgerwriting profile representation of the forger writing profilerepresentations; and the computer system comparing handwriting in atleast one of the one or more non-signature information fields of thedocument provided to the computer system to handwriting in acorresponding non-signature information field from the at least onedocument comprising forged information associated with the known forgerin the at least one forger writing profile representation, whereincomparing handwriting in at least one of the one or more non-signatureinformation fields of the document to handwriting in a correspondingnon-signature information field from the at least one documentcomprising forged information comprises: the computer system comparinghandwriting in an amount field of the document provided to the computersystem to handwriting in a corresponding amount field from the at leastone document comprising forged information associated with the knownforger in the at least one forger writing profile representation; thecomputer system determining one or more variances in handwriting withinthe amount field of the document provided to the computer system,wherein the one or more variances in handwriting within the amount fieldinclude written characters of the same type being written by at leasttwo different individuals; identifying the document provided to thecomputer system as a document comprising forged information from: anapproximate match of the handwriting associated with the known forger inthe at least one forger writing profile representation with thehandwriting in the document provided to the computer system; and thedetermined one or more variances within the amount field including thewritten characters of the same type being written by at least twodifferent individuals; and assessing fraud in the document provided tothe computer system using at least one of the comparisons, whereinevidence of fraud comprises the identification of the document providedto the computer system as a document comprising forged information basedon the approximate match of the handwriting associated with the knownforger with the handwriting in the document provided to the computersystem and the determined one more variances within the amount field ofthe document provided to the computer system.
 2. The method of claim 1,further comprising comparing writing in at least two of the informationfields of the document provided to the computer system to at least twoforger writing profile representations from at least one informationfield of at least one document comprising forged information.
 3. Themethod of claim 1, further comprising comparing writing in at least twoof the information fields of the document provided to the computersystem to at least two forger writing profile representations from atleast two information fields of at least one document comprising forgedinformation.
 4. The method of claim 1, wherein at least one forgerwriting profile representation is a member of a forger writing profileassociated with a known forger, and further comprising identifying theforger of the document provided to the computer system from the forgerwriting profile if the document provided to the computer system isidentified as forged.
 5. The method of claim 1, wherein at least oneforger writing profile representation comprises a forger identity andwriting of the forger, and further comprising identifying a forger ofthe document provided to the computer system from the forger writingprofile.
 6. The method of claim 1, wherein providing the document to thecomputer system comprises providing images of the document to thecomputer system.
 7. The method of claim 1, further comprising assessingfraud in the document provided to the computer system using at least twoof the comparisons.
 8. The method of claim 1, wherein comparing writingin the at least two information fields of the document provided to thecomputer system comprises comparing at least one characteristic of thewriting.
 9. The method of claim 1, wherein evidence of fraud comprisesat least a portion of the handwriting in at least two of the informationfields of the document provided to the computer system to approximatelymatch at least one forger writing profile representation.
 10. The methodof claim 1, wherein assessing fraud in the document provided to thecomputer system comprises assessing fraud using at least two of thecomparisons, wherein evidence of fraud comprises at least a portion ofthe writing in at least one of the information fields of the documentprovided to the computer system to approximately match at least oneforger writing profile representation.
 11. The method of claim 1,further comprising comparing writing in at least two of the informationfields of the document provided to the computer system to at least oneforger writing profile representation from at least two informationfields of at least one forged document.
 12. The method of claim 1,further comprising comparing writing in at least two of the informationfields of the document provided to the computer system to at least twoforger writing profile representations from at least one informationfield of at least one forged document.
 13. The method of claim 1,further comprising comparing handwriting in at least two of theinformation fields of the document provided to the computer system to atleast two forger writing profile representations from at least twoinformation fields of at least one forged document.
 14. The method ofclaim 1, wherein the document provided to the computer system is apayment instrument.
 15. The method of claim 1, wherein providing thedocument to the computer system comprises obtaining images of writing ofat least one information field.
 16. The method of claim 1, furthercomprising creating a mathematical representation of the writing in atleast one information field.
 17. The method of claim 1, wherein thewriting in the at least two information fields of the document providedto the computer system comprises at least one image.
 18. The method ofclaim 1, wherein the writing in the at least two information fields ofthe document provided to the computer system comprises at least one typeof written information.
 19. The method of claim 1, wherein the writingin the at least two information fields of the document provided to thecomputer system comprises at least one type of written information, andwherein at least one type of written information comprises a word type.20. The method of claim 1, wherein the writing in the at least twoinformation fields of the document provided to the computer systemcomprises at least one type of written information, and wherein at leastone type of written information comprises a character type.
 21. Themethod of claim 1, wherein the writing in the at least two informationfields of the document provided to the computer system comprises atleast one global feature of the writing.
 22. The method of claim 1,wherein the writing in the at least two information fields of thedocument provided to the computer system comprises at least one localfeature of the writing.
 23. The method of claim 1, wherein the writingin the at least two information fields of the document provided to thecomputer system comprises at least one syntax pattern.
 24. The method ofclaim 1, wherein the writing in the at least two information fields ofthe document provided to the computer system comprises at least onelexicon name for at least one information field.
 25. The method of claim1, wherein at least one forger writing profile representation comprisesat least one mathematical representation.
 26. The method of claim 1,wherein at least one forger writing profile representation comprises atleast one image.
 27. The method of claim 1, wherein at least one forgerwriting profile representation comprises at least one writing variant ofan example of at least one type of written information, and wherein atleast one type of written information comprises a word type.
 28. Themethod of claim 1, wherein at least one forger writing profilerepresentation comprises at least one writing variant of an example ofat least one type of written information, and wherein at least one typeof written information comprises a character type.
 29. The method ofclaim 1, wherein at least one forger writing profile representationcomprises at least one writing variant of an example of at least onetype of written information, and further comprising determining at leastone of the variants with a cluster algorithm.
 30. The method of claim 1,wherein at least one forger writing profile representation comprises atleast one global characteristic of the writing.
 31. The method of claim1, wherein at least one forger writing profile representation comprisesat least one local characteristic of the writing.
 32. The method ofclaim 1, wherein at least one forger writing profile representationcomprises at least one variant of a syntax pattern.
 33. The method ofclaim 1, wherein at least one forger writing profile representationcomprises at least one lexicon name for at least one information field.34. The method of claim 1, wherein the document provided to the computersystem is a payment instrument, wherein comparing handwriting in atleast one of the one or more other non-signature information fields ofthe document provided to the computer system to handwriting in acorresponding non-signature information field from the at least onedocument comprising forged information associated with the known forgerin the at least one forger writing profile representation comprisescomparing handwriting in a payee field of the payment instrument tohandwriting in a corresponding payee field from at least one paymentinstrument comprising forged information associated with the knownforger in the at least one forger writing profile representation. 35.The method of claim 1, wherein the document provided to the computersystem is a payment instrument, wherein comparing handwriting in atleast one of the one or more other non-signature information fields ofthe document provided to the computer system to handwriting in acorresponding non-signature information field from the at least onedocument comprising forged information associated with the known forgerin the at least one forger writing profile representation comprisescomparing handwriting in a date field of the payment instrument tohandwriting in a corresponding date field from at least one paymentinstrument comprising forged information associated with the knownforger in the at least one forger writing profile representation. 36.The method of claim 1, wherein the document provided to the computersystem is a payment instrument, wherein one of the information fieldsfor which handwriting is compared is a signature field of the paymentinstrument, wherein at least one of the one or more non-signatureinformation fields of the document provided to the computer system forwhich writing is compared is a non-signature field of the paymentinstrument.
 37. The method of claim 1, further comprising: analyzing acorrelation of information between an amount field in the documentprovided to the computer system and a payee field in the documentprovided to the computer system, wherein analyzing a correlation ofinformation between the amount field in the document provided to thecomputer system and a payee field in the document provided to thecomputer system comprising analyzing the amount field of the documentprovided to the computer system based on what information is in thepayee field of the document provided to the computer system.
 38. Themethod of claim 1, wherein the compared amount field is a courtesyamount field, wherein a portion of the written characters in thecourtesy amount field are assessed to be written by the known forgerbased on a comparison between handwriting in the courtesy amount fieldof the document provided to the computer system to handwriting in thecorresponding amount field from the at least one document comprisingforged information.
 39. The method of claim 1, wherein the comparedamount field is a courtesy amount field, wherein determining variancesin handwriting within the amount field of the document provided to thecomputer system comprises determining that, in the courtesy amount fieldof the document provided to the computer system, at least one of thewritten characters of the same type is a number added by alteration by aforger.
 40. The method of claim 1, further comprising comparingpre-printed information in the document provided to the computer systemagainst at least one stock profile representation, and assessingpotential fraud based on the comparison of the pre-printed informationagainst the stock profile representation.
 41. The method of claim 1,wherein assessing fraud in the document provided to the computer systemusing at least one of the comparisons comprises performing two or moredifferent fraud tests based on the comparison of one of the informationfields, and assigning a different fraud weight to at least one of thefraud tests than to at least one other of the fraud tests.
 42. Themethod of claim 41, wherein one of the fraud tests involves a courtesyamount field, wherein the fraud test relating to the courtesy amountfield is weighted higher than at least one other fraud test.
 43. Themethod of claim 41, wherein one of the fraud tests involves a legalamount field, wherein the fraud test relating to the legal amount fieldis weighted higher than at least one other fraud test.
 44. The method ofclaim 1, wherein at least one of the non-signature field informationfields of the document provided to the computer system is a payee field,the method further comprising determining whether a name in the payeefield of the document matches at least one payee name from a lexicon ofsuspicious payee names, wherein a suspicious payee name is a payee namefrequently involved in transactions with high fraud risk.
 45. The methodof claim 1, further comprising analyzing a correlation of informationbetween an amount field in the document provided to the computer systemand a payee field in the document provided to the computer systemwherein analyzing the correlation of information between at least two ofthe non-signature information fields comprises reading information fromat least one cross-correlation table.
 46. A system, comprising: a CPU; adata memory coupled to the CPU; and a system memory coupled to the CPU,wherein the system memory is configured to store one or more computerprograms executable by the CPU, and wherein the computer programs areexecutable to implement a method for identifying a document comprisingforged information, the method comprising: providing the document to thecomputer system, wherein the document provided to the computer systemcomprises one or more signature information fields and one or morenon-signature information fields; comparing handwriting in at least twoof the information fields of the document provided to the computersystem to one or more forger writing profile representations from one ormore information fields of at least one document comprising forgedinformation associated with a known forger and from one or morenon-signature information fields of the at least one document comprisingforged information associated with the known forger, wherein comparingwriting in the at least two information fields comprises: comparinghandwriting in at least one of the signature information fields of thedocument provided to the computer system to handwriting from at leastone signature information field of the document comprising forgedinformation associated with the known forger in at least one forgerwriting profile representation of the forger writing profilerepresentations; and comparing handwriting in at least one of the one ormore non-signature information fields of the document provided to thecomputer system to handwriting in a corresponding non-signatureinformation field from the at least one document comprising forgedinformation associated with the known forger in the at least one forgerwriting profile representation, wherein comparing handwriting in atleast one of the one or more non-signature information fields of thedocument to handwriting in a corresponding non-signature informationfield from the at least one document comprising forged informationcomprises: comparing handwriting in an amount field of the documentprovided to the computer system to handwriting in a corresponding amountfield from the at least one document comprising forged informationassociated with the known forger in the at least one forger writingprofile representation; determining one or more variances in handwritingwithin the amount field of the document provided to the computer system,wherein the one or more variances in handwriting within the amount fieldinclude written characters of the same type being written by at leasttwo different individuals; identifying the document provided to thecomputer system as a document comprising forged information from: anapproximate match of the handwriting associated with the known forger inthe at least one forger writing profile representation with thehandwriting in the document provided to the computer system; and thedetermined one or more variances within the amount field including thewritten characters of the same type being written by at least twodifferent individuals; and assessing fraud in the document provided tothe computer system using at least one of the comparisons, whereinevidence of fraud comprises the identification of the document providedto the computer system as a document comprising forged information basedon the approximate match of the an approximate match of the handwritingassociated with the known forger in the at least one forger writingprofile representation with the handwriting in the document provided tothe computer system; and the determined one or more variances within theamount field including the written characters of the same type beingwritten by at least two different individuals; and assessing fraud inthe document provided to the computer system using at least one of thecomparisons, wherein evidence of fraud comprises the identification ofthe document provided to the computer system as a document comprisingforged information based on the approximate match of the handwritingassociated with the known forger with the handwriting in the documentprovided to the computer system and the determined one more varianceswithin the amount field of the document provided to the computer system.47. The system of claim 46, wherein at least one forger writing profilerepresentation is a member of a forger writing profile associated with aknown forger, and further comprising identifying the forger of thedocument from the forger writing profile if the document is identifiedas forged.
 48. A tangible, computer readable storage medium comprisingprogram instructions stored thereon, wherein the program instructionsare computer-executable to implement a method for identifying a documentcomprising forged information, the method comprising: providing thedocument to the computer system, wherein the document provided to thecomputer system comprises one or more signature information fields andone or more non-signature information fields; comparing handwriting inat least two of the information fields of the document provided to thecomputer system to one or more forger writing profile representationsfrom one or more signature information field of at least one documentcomprising forged information associated with a known forger and fromone or more non-signature information fields of the at least onedocument comprising forged information associated with the known forger,wherein comparing writing in the at least two information fieldscomprises: comparing handwriting in at least one of the signatureinformation fields of the document provided to the computer system tohandwriting from at least one signature information field of thedocument comprising forged information associated with the known forgerin at least one forger writing profile representation of the forgerwriting profile representations; and comparing handwriting in at leastone of the one or more non-signature information fields of the documentprovided to the computer system to handwriting in a correspondingnon-signature information field from the at least one documentcomprising forged information associated with the known forger in the atleast one forger writing profile representation, wherein comparinghandwriting in at least one of the one or more non-signature informationfields of the document to handwriting in a corresponding non-signatureinformation field from the at least one document comprising forgedinformation comprises: comparing handwriting in an amount field of thedocument provided to the computer system to handwriting in acorresponding amount field from the at least one document comprisingforged information associated with the known forger in the at least oneforger writing profile representation; determining one or more variancesin handwriting within the amount field of the document provided to thecomputer system, wherein the one or more variances in handwriting withinthe amount field include written characters of the same type beingwritten by at least two different individuals; identifying the documentas a document comprising forged information from: an approximate matchof the handwriting associated with the known forger in the at least oneforger writing profile representation with the handwriting in thedocument provided to the computer system; and the determined one or morevariances within the amount field including the written characters ofthe same type being written by at least two different individuals; andassessing fraud in the document provided to the computer system using atleast one of the comparisons, wherein evidence of fraud comprises theidentification of the document provided to the computer system as adocument comprising forged information based on the approximate match ofthe handwriting associated with the known forger with the handwriting inthe document provided to the computer system and the determined one morevariances within the amount field of the document provided to thecomputer system.